Why you should patch the Windows QueueJumper vulnerability immediately

Microsoft patched over 100 vulnerabilities this week in its merchandise, together with a zero-day privilege escalation flaw used within the wild by a ransomware gang. Nevertheless, one other important vulnerability that may be simply exploited to take over Home windows programs remotely over native networks and the web is prone to be of extra curiosity to attackers and see widespread exploitation sooner or later.

Dubbed QueueJumper and tracked as CVE-2023-21554, the flaw was found by researchers from safety agency Test Level Software program Applied sciences and is rated 9.8 out of 10 on the CVSS severity scale. Microsoft’s personal advisory lists the assault complexity as low and the exploitability evaluation as extra seemingly. The impression is distant code execution.

Distant code execution in legacy Message Queuing service

The flaw is in a Home windows part known as the Microsoft Message Queuing (MSMQ) service that enables purposes to speak and guarantee message supply even when networks and programs are briefly offline by maintaining messages in a queue. This service has existed in Home windows since Home windows NT and has seen a number of variations over time. When energetic, the service accepts communications on port 1801 TCP.

Despite the fact that MSMQ is usually thought of a legacy service that has been outdated by newer communication applied sciences, it nonetheless exists as an optionally available part in Home windows 11 and the most recent model of Home windows Server. Furthermore, purposes which are designed to make use of it would allow it at set up time, which could occur with out customers or admins realizing.

Microsoft’s documentation offers examples of use instances for MSMQ reminiscent of mission-critical monetary providers for digital commerce, embedded and hand-held purposes like these utilized in baggage routing programs in airports, and gross sales automation purposes for touring gross sales representatives. It is value noting that this documentation was written in 2016, so the listing of purposes that use it’s definitely not exhaustive.

In truth, in accordance with Test Level researcher Haifei Li, one software that is broadly utilized by corporations allows the MSMQ service in the course of the set up course of with default settings: Microsoft Trade Server. On-premise Microsoft Trade Servers have been a favourite goal for attackers, particularly cyberespionage teams, in recent times.

“We now know the assault vector sends packets to the service port 1801/tcp,” Li stated. “In an effort to have a greater understanding of the potential impression in the true world of this service, CPR [Check Point Research] did a full Web scan. Surprisingly, we discovered that greater than ~360,000 IPs have the 1801/tcp open to the web and are operating the MSMQ service. Observe that this solely consists of the variety of hosts dealing with the Web and doesn’t account for computer systems internet hosting the MSMQ service on inside networks, the place the quantity needs to be way more.”

Test Level recommends that directors decide whether or not the Message Queuing service is operating on their programs and if they will disable it with out impacting important purposes. If the service is required and Microsoft’s patch cannot be utilized instantly, organizations ought to block entry to TCP port 1801 from untrusted IP addresses utilizing a firewall. Observe that this is not going to shield the system from assaults within the case of a neighborhood community compromise and lateral motion exercise that enables attackers to compromise one of many trusted programs on the firewall’s IP whitelist. Lateral motion is a standard approach employed by most APT and ransomware gangs.

Different Microsoft Home windows vulnerabilities that want speedy consideration

One other distant code execution vulnerability with a severity rating of 9.8 that is just like MSMQ’s was patched within the Home windows Pragmatic Basic Multicast (PGM) part. This flaw is tracked as CVE-2023-28250 and can be depending on the MSMQ being energetic and the system accepting connections on TCP port 1801. Nevertheless, Microsoft considers exploitation of this flaw much less seemingly.

The zero-day vulnerability patched by Microsoft that is reportedly already utilized by a ransomware gang known as Nokoyawa is tracked as CVE-2023-28252 and is positioned within the Home windows Frequent Log File System (CLFS) driver. This can be a privilege escalation vulnerability with a severity rating of seven.8 that can’t be exploited remotely however might be exploited regionally on the system to achieve code execution as SYSTEM. Microsoft patched two related CLFS vulnerabilities over the previous yr, in February 2023 and in September 2022.

“April 2023 additionally sees 45 separate distant code execution (RCE) vulnerabilities patched, which is a big uptick from the typical of 33 per thirty days over the previous three months,” Adam Barnett, lead software program engineer at safety agency Rapid7, tells CSO by way of electronic mail. “Microsoft charges seven of this month’s RCE vulnerabilities as important, together with two associated vulnerabilities with a CVSSv3 base rating of 9.8.”